Concrete5 version 8.5.4 suffers from a persistent cross site scripting vulnerability.
This Metasploit module exploits an unauthenticated arbitrary file upload via an insecure POST request to Fortilogger. It has been tested on version 4.4.2.2 in Windows 10 Enterprise.
This archive contains all of the 189 exploits added to Packet Storm in February, 2021.
Zen Cart 1.5.7b – Remote Code Execution (Authenticated)
Tiny Tiny RSS – Remote Code Execution
Web Based Quiz System 1.0 – ‘name’ Persistent/Stored Cross-Site Scripting
Web Based Quiz System 1.0 – ‘MCQ options’ Persistent/Stored Cross-Site Scripting
VMware vCenter Server 7.0 – Unauthenticated File Upload
FortiLogger 4.4.2.2 – Unauthenticated Arbitrary File Upload (Metasploit)
WiFi Mouse 1.7.8.5 – Remote Code Execution